Sql injection

SQL injection vulnerability in GBgallery.php in the GB Gallery Slideshow plugin 1.5 for WordPress allows remote administrators to execute arbitrary SQL commands via the selectedgroup parameter in a gbajaxgetgroup action to wp-admin/admin-ajax.php...

CVE-2014-8375

GB Gallery Slideshow WordPress plugin 1.5 contains a SQL injection vulnerability in GBgallery.php. The issue is exploitable via the selected_group parameter in the gb_ajax_get_group action called through wp-admin/admin-ajax.php, allowing remote attackers (with appropriate privileges) to execute a...

PT-2014-8498

Name of the Vulnerable Software and Affected Versions GB Gallery Slideshow plugin version 1.5 Description The issue allows remote administrators to execute arbitrary SQL commands. This is achieved by exploiting the selected group parameter in a gb ajax get group action to the...

Sql injection

Multiple SQL injection vulnerabilities in Banana Dance B.2.6 and earlier allow remote attackers to execute arbitrary SQL commands via the 1 return, 2 display, 3 table, or 4 search parameter to functions/suggest.php; 5 the id parameter to functions/widgets.php, 6 the category parameter to...

PT-2014-2304

Name of the Vulnerable Software and Affected Versions Banana Dance versions B.2.6 and earlier Description The issue allows remote attackers to execute arbitrary SQL commands. This can be achieved via several parameters to different functions, including the return, display, table, or search...

CVE-2012-5244: Improper Neutralization of Special Elements used in an SQL Command

Multiple SQL injection vulnerabilities in Banana Dance B.2.6 and earlier allow remote attackers to execute arbitrary SQL commands via the 1 return, 2 display, 3 table, or 4 search parameter to functions/suggest.php; 5 the id parameter to functions/widgets.php, 6 the category parameter to...

Cross site scripting

Cross-site scripting XSS vulnerability in the Google Calendar Events plugin before 2.0.4 for WordPress allows remote attackers to inject arbitrary web script or HTML via the gcefeedids parameter in a gceajax action to wp-admin/admin-ajax.php...

CVE-2014-7138

Cross-site scripting XSS vulnerability in the Google Calendar Events plugin before 2.0.4 for WordPress allows remote attackers to inject arbitrary web script or HTML via the gcefeedids parameter in a gceajax action to wp-admin/admin-ajax.php...

CVE-2014-7138

Cross-site scripting XSS vulnerability in the Google Calendar Events plugin before 2.0.4 for WordPress allows remote attackers to inject arbitrary web script or HTML via the gcefeedids parameter in a gceajax action to wp-admin/admin-ajax.php...

PT-2014-7799

Name of the Vulnerable Software and Affected Versions Google Calendar Events plugin versions prior to 2.0.4 Description A cross-site scripting XSS issue allows remote attackers to inject arbitrary web script or HTML via the gce feed ids parameter in a "gce ajax" action to "wp-admin/admin-ajax.php...

CVE-2014-7138: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in the Google Calendar Events plugin before 2.0.4 for WordPress allows remote attackers to inject arbitrary web script or HTML via the gcefeedids parameter in a gceajax action to wp-admin/admin-ajax.php...

CVE-2014-6315

Multiple cross-site scripting XSS vulnerabilities in the Web-Dorado Photo Gallery plugin 1.1.30 and earlier for WordPress allow remote attackers to inject arbitrary web script or HTML via the 1 callback, 2 dir, or 3 extensions parameter in an addImages action to wp-admin/admin-ajax.php...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in the Web-Dorado Photo Gallery plugin 1.1.30 and earlier for WordPress allow remote attackers to inject arbitrary web script or HTML via the 1 callback, 2 dir, or 3 extensions parameter in an addImages action to wp-admin/admin-ajax.php...

CVE-2014-6315

Multiple cross-site scripting XSS vulnerabilities in the Web-Dorado Photo Gallery plugin 1.1.30 and earlier for WordPress allow remote attackers to inject arbitrary web script or HTML via the 1 callback, 2 dir, or 3 extensions parameter in an addImages action to wp-admin/admin-ajax.php...

PT-2014-7148

Name of the Vulnerable Software and Affected Versions Web-Dorado Photo Gallery plugin versions 1.1.30 and earlier Description The issue allows remote attackers to inject arbitrary web script or HTML via vulnerable parameters in an addImages action to "wp-admin/admin-ajax.php" API endpoint. The...

CVE-2014-6315: Improper Neutralization of Input During Web Page Generation

Multiple cross-site scripting XSS vulnerabilities in the Web-Dorado Photo Gallery plugin 1.1.30 and earlier for WordPress allow remote attackers to inject arbitrary web script or HTML via the 1 callback, 2 dir, or 3 extensions parameter in an addImages action to wp-admin/admin-ajax.php...

OpenSIS ajax.php modname Code Execution (CVE-2013-1349)

A remote code execution vulnerability has been reported in OpenSIS. The vulnerability is due to insufficient validation of modname parameter while parsing requests to ajax.php module. A remote attacker can exploit this vulnerability by sending a specially crafted request to the vulnerable server...

CVE-2014-7152

Cross-site scripting XSS vulnerability in the Easy MailChimp Forms plugin 3.0 through 5.0.6 for WordPress allows remote attackers to inject arbitrary web script or HTML via the updateoptions action to wp-admin/admin-ajax.php...

Cross site scripting

Cross-site scripting XSS vulnerability in the Easy MailChimp Forms plugin 3.0 through 5.0.6 for WordPress allows remote attackers to inject arbitrary web script or HTML via the updateoptions action to wp-admin/admin-ajax.php...

CVE-2014-7152

Cross-site scripting XSS vulnerability in the Easy MailChimp Forms plugin 3.0 through 5.0.6 for WordPress allows remote attackers to inject arbitrary web script or HTML via the updateoptions action to wp-admin/admin-ajax.php...